CVE-2022-0766
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in Calibre-Web, an open-source web application for managing eBook collections. Attackers can exploit this to make the server send unauthorized requests to internal or external systems, potentially accessing sensitive data or services. All users running Calibre-Web versions prior to 0.6.17 are affected.
💻 Affected Systems
- Calibre-Web
📦 What is this software?
Calibre Web by Janeczku
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the server, data exfiltration, or lateral movement to internal systems through SSRF chaining with other vulnerabilities.
Likely Case
Unauthorized access to internal services, metadata leakage, or denial of service through resource exhaustion.
If Mitigated
Limited impact with proper network segmentation and input validation, potentially only affecting the Calibre-Web instance itself.
🎯 Exploit Status
Exploitation requires authenticated access to the Calibre-Web application. The fix commit shows specific vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.6.17
Vendor Advisory: https://github.com/janeczku/calibre-web/commit/965352c8d96c9eae7a6867ff76b0db137d04b0b8
Restart Required: Yes
Instructions:
1. Backup your Calibre-Web data and configuration. 2. Update to version 0.6.17 or later using your package manager or by downloading from GitHub. 3. Restart the Calibre-Web service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Network Segmentation
allRestrict outbound network access from the Calibre-Web server to only necessary services.
Input Validation
allImplement additional input validation for URL parameters in the application configuration.
🧯 If You Can't Patch
- Implement strict network controls to limit the server's outbound connections
- Disable or restrict access to vulnerable endpoints if possible
🔍 How to Verify
Check if Vulnerable:
Check the Calibre-Web version in the web interface or configuration files. If version is below 0.6.17, the system is vulnerable.Check Version:
Check the Calibre-Web web interface or examine the application's version file if available.Verify Fix Applied:
After updating, verify the version shows 0.6.17 or higher in the web interface or via the version check command.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from the Calibre-Web server
- Requests to internal IP addresses or unusual domains
Network Indicators:
- Unexpected HTTP traffic from Calibre-Web server to internal services
SIEM Query:
source="calibre-web" AND (dest_ip=10.0.0.0/8 OR dest_ip=172.16.0.0/12 OR dest_ip=192.168.0.0/16)🔗 References
- https://github.com/janeczku/calibre-web/commit/965352c8d96c9eae7a6867ff76b0db137d04b0b8
- https://huntr.dev/bounties/7f2a5bb4-e6c7-4b6a-b8eb-face9e3add7b
- https://github.com/janeczku/calibre-web/commit/965352c8d96c9eae7a6867ff76b0db137d04b0b8
- https://huntr.dev/bounties/7f2a5bb4-e6c7-4b6a-b8eb-face9e3add7b
